
United States Patent and Trademark Office 



UNITED STATES DEPARTMENT OF COMMERCE 
United States Patent and Trademark Office 
Address: COMMISSIONER FOR PATENTS 
P.O. Box 1450 

Alexandria, Virginia 22313-1450 
www.uspto.gov 



APPLICATION NO. 



FILING DATE 



FIRST NAMED INVENTOR 



ATTORNEY DOCKET NO. 



CONFIRMATION NO. 



09/641,407 



08/17/2000 



05/07/2004 



7265 7590 

MICHAELSON and WALLACE 

PARKWAY 109 OFFICE CENTER 

328 NEWMAN SPRINGS RD 

P O BOX 8489 

RED BANK, NJ 07701 



Hamish D.S. Martin 



3Com-76 (3106NMDUSP) 



4674 



EXAMINER 



ORTIZ. XIOMARA Y 



ART UNIT 



PAPER NUMBER 



2141 

DATE MAILED: 05/07/2004 



7 



Please find below and/or attached an Office conamunication concerning this application or proceeding. 



PTO-90C (Rev. 10/03) 



1 \^^^ 


Application No^^ 


Applicant(s) 




(^^^f/*/ft jfl^tf flirt ^1 invttfftn^m^ 
^JsTICG MClSUsl OUiUlfnciiry 


09/641,407 


MARTIN ET AL 




Examiner 

Xiomara Y. Ortiz 


Art Unit 

2141 





~ Tho MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

• If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1 .704(b). 

Status 

1 )S Responsive to communication(s) filed on 23 February 2004 , 
2a)13 This action is FINAL. 2b)n Tliis action is non-final. 

3) n Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 1935 CD. 11, 453 O.G. 213, 

Disposition of Claims 

4) S Claim(s) 1-28 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) n Claim(s) is/are allowed. 

6) 13 Claim(s) 1-6,10-21 and 24-28 is/are rejected. 

7) 13 Claim(s) 7-9,22 and 23 is/are objected to,. 

8) \3 Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) 0 The specification is objected to by the Examiner. 

10)0 The drawing(s) filed on is/are: a)n accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1121(d). 
1 1 )□ The oath or declaration is objected to by the Examiner. Note the attached Office Action or fomri PTO-152. 

Priority under 35 U.S.C. § 1 1 9 

12)0 Acl^nowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f). 
a)n All b)n Some * c)n None of: 

1 .□ Certified copies of the priority documents have been received. 

2.n Certified copies of the priority documents have been received in Application No. . 



3.n Copies of the certified copies of the priority documents have been received in this National Stage 
application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 



Attach ment(s) 

1) 13 Notice of References Cited (PTO-892) 

2) n Notice of Draftsperson's Patent Drawing Review (PTO-948) 

3) 13 Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 

Paper No(s)/IVIail Date 4. 



4) [I] Interview Summary (PTO-413) 

Paper No(s)/Mail Date. . 

5) EH Notice of Informal Patent Application (PTO-152) 

6) □ Other: , 



U.S. Patent and Trademark Office 

PTOL-326 (Rev. 1-04) 



Office Action Summary 



Part of Paper No./Mail Date 7 





Application/Control Number: 09/641,407 
Art Unit: 2141 



Page 2 



DETAILED ACTION 



1. 



This action is responsive to the amendment and remarks filed on February 23,2004. 



Claims 1-28 are presented for further examination. 



Claim Rejections - 35 USC § 103 



2. The following is a quotation of 35 U.S.C 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

3. Claims 1, 2, 3, 4, 5, 6, 10, 11, 12, 14, 15, 16, 17, 18, 19, 20, 21 and 26 are rejected under 
35 U.S.C. 103(a) as being unpatentable over Kosbab U.S Patent No. 5917808 in view of McKee 
U.S. Patent No. 5712981. 

Regarding claim 1, 16, and 26, Kosbab discloses receiving data representing 
communications on the network, the data containing source device, destination device, data 
transfer protocol, and data volume information for communication presented therein; (Kosbab 
col4 lines 45-56 for receiving network traffic in the form of frames between the nodes of the 
LAN (Ethernet). It is well known that frames contain the source and destination address, the type 
of data (protocol), and data with a maximum of 1 500 bytes); identifying, from the received data, 
data relating to one or more relevant server protocols (col. 8 lines 16-30 where the frames are 
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related to one or more server protocols as TCP/IP DSN, IPX SAP, NetBios, etc.). But Kosbab 
fails to disclose using the identified data to determine as a server, the device, which has the 
highest data volume for communications, in which it is the source, or destination device and in 
which at least a threshold number of other devices are involved. 

However, McKee teaches identifying the candidate local server with the highest linkage 
which is measured in terms of the number of frames involved in the traffic with the associated 
nodes, number of associates nodes (that is, a plurality of nodes which means more than one, 
being this a threshold), and the number of bytes involved in the traffic with the associated nodes 
(McKee coll lines 66-67 to col.2 lines 1-24), where the program for extracting servers 10 
analyses traffic data presented in traffic elements 22 to produce a global server list 23 and a local 
servers list 24 (McKee col6 lines 40-50), and examines the traffic data represented by the traffic 
elements and creates a list of all the traffic nodes that is nodes transmitting or receiving traffic 
(source or destination) (McKee col. 7 lines 65-65 to col. 8 lines 1-9). 

Therefore at the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to modify the above invention suggested by Kosbab and combining it 
with the invention disclosed by McKee. 

One of ordinary skill in the art would have been motivated to do this combination in 
order to upon local servers being identified, make a suggestion as to whether any of these local 
servers should be moved to another logical segment and as to be worthwhile splitting a segment 
between two associated local segments (McKee abstract), to provide a network analysis method 
that facilitates an appreciation of operation of the network at a sub-network level (McKee col. 1 
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lines 31-33), and for once the local server being identified, further analysis can be effected to 
determine how network performance can be improved (McKee col 2 lines 41-43). 

Regarding claim 2 and 17, the above combination discloses all the Hmitations in claim 1 
and 16, and also includes that for each communication included in the received data, comparing 
the data transfer protocol with the at least one predefined server protocol, and when the 
conq)arison results in a match, identifying the corresponding received data as a relating to a 
relevant server protocol (Kosbab col. 8 lines 16-41 comparing the frame information (which 
contains the protocol) to server frame types (like TCP/IP DSN, IPX SAP, NetBios which are 
server protocols) and if there is a match between the frame information and any of the server 
frame type, identify entry as a server). 

Regarding claim 3 and 18, the combination discloses all the limitations in claim 2 and 16, 
and also teaches, identifying further includes marking the identified data that (Kosbab col. 8 lines 
36-41 for after comparing the frame information with the server frame type, and having a match, 
the corresponding entry is tagged as a server). 

Regarding claim 4 and 19, the combination discloses all the limitations in claim 1 and 16, 
and also discloses identifying the devices involved in the communications represented in the 
identified data using the source device or destination device information and for each identified 
device (McKee col. 7 lines 6-22 for identifying global and local servers depending on the depth 
of the detail provided by the traffic data. The traffic data can be simply based on source and 
destination node address (source and destination device information) of message packets passed 
across the network), and for each identified device, determining the total volume of data 
transferred during communications represented in the identified data involving the device using 
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the volume information (McKee col. 8 lines 15-25 for measure the traffic volume in terms of 
packets, frames, or bytes exchanged with each logical segment provided the total traffic field of 
each traffic element 22 records the appropriate information). 

Regarding claim 5 and 20, the combination discloses all the limitations in claim 4 and 19, 
but neither Kosbab nor McKee teaches identifying the device with the highest total volume. 
However, McKee teaches that identifying local server by examining the traffic data in where a 
server is a node with the highest linkage thereto (McKee col.l lines 66-67 to col.2 lines 24), 
where the linkage of a node is measured in terms of number of associated nodes, number of 
frames involved in the traffic or number of bytes involved in the traffic with the associated 
nodes. Therefore in order to identify a server it has to identify the node with the highest number 
of nodes, highest number of frames or bytes. 

Regarding claim 6 and 21, the combination discloses all the limitations in claim 5 and 20, 
and also discloses determining the number of other devices involved in communications, 
represented in the identified data, with the identified device (Kosbab col.2 lines 21-23 for 
determining the number and types of devices that are present in the LAN). 

Regarding claim 10, the combination discloses all the limitations in claim 1, and also 
discloses that the received data comprises network traffic data (Kosbab col 4 lines 46-47 for 
receiving network traffic in form of frames). 

Regarding claim 11, the combination disclose all the limitations in claim 10, and also 
discloses collecting said network traffic data at a location on the network using a traffic monitor 
(Kosbab col.l lines 6-9 for method for a LAN using a test instrument and a method for 
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identifying the types of devices present on a local area network by passively monitoring network 
traffic). 

Regarding claim 12, the combination discloses all the limitations in claim 11, and also 
discloses data being collected over a predetermined time period (Kosbab col. 7 lines 13-16 for 
frames being collected over a period of time desired by the user of the test instrument 10). 

Regarding claim 14, the combination discloses all the limitations in claim 1, but neither 
Kosbab nor McKee teaches a threshold number being an integer greater than one. However, 
McKee teaches that identifying local server by examining the traffic data in where a server is a 
node with the highest linkage thereto (McKee coll lines 66-67 to col.2 lines 24), where the 
linkage of a node is measured in terms of number of associated nodes, meaning a plurality of 
nodes, thus implying more than one. 

Regarding claim 15, the combination discloses, all the limitations in claim 1 and also 
disclose relevant server protocols as TCP/IP DNS, IPX SAP, IPX, and Net BIOS (Kosbab col.8 
lines 20-32). 

4. Claims 13, 24, 25, 27 and 28 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Kosbab U.S Patent No. 5917808 in view of McKee U.S Patent No. 5712981 in further view 
ofDiebboll U.S. Patent No. 5886643. 

Regarding claim 13 and 25, Kosbab in view of McKee discloses all the Umitation in 
claim 1 1 and 24, but fails to disclose that the network traffic data is RM0N2 data. However 
DieboU teaches using RMON II as a standard for collecting data (DieboU col4 lines 34-48). 
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Therefore at the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to modify the above invention suggested by Kosbab in view of McKee 
and combining it with the invention disclosed by DieboU. 

One of ordinary skill in the art would have been motivated to do this combination in 
order to collect data in accordance with a known standard as RMON II which was promulgated 
by the Internet Engineering task force, which specifies as a protocol for communicating with the 
probe and specifies the format of the Management Information Base (MIB), which defines the 
kinds of data that is stored and how to collect and retrieve that data (DieboU coL4 lines 34-52). 

Regarding claim 24 and claim 27, Kosbab in view of McKee discloses all the limitations 
in claim 16 and claim 26, and also discloses program means for retrieving network traffic data 
from the network device at a location on the network, and program means for storing the data in 
a data table in the form of source, destination, application and volume. Kosbab teaches a frame 
processor implemented in hardware, software or a combination thereof within the test instrument 
10 where the test instrument is coupled to the LAN 12 to receive network traffic in form of 
frames (Kosbab coL4 lines 45-56). Kosbab also teaches storing the accumulated information in a 
station database 104 (Kosbab col.4 lines 57-60) and a representation of the station database 104 
in form of a table (Kosbab col. 5 lines 1-8 and fig. 4) containing the field of the IP and Mac 
address of the device sending the frames (source) and the frame count, which is the number of 
frames that has being received (volume) (Kosbab col. 5 lines 9-20). But the combination fails to 
disclose the destination and the appHcation data in the table. However, DieboU teaches a 
database to store data retrieved from the probes (Dieboll col. 6 lines 19-29) in form of a table 
(DieboU fi.2) which contains a destination field 76 which identifies the intended recipient of the 
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packet data (DieboU col.6 lines 30-51 and fig.2)5 and a protocol field 84 which identifies the 
protocol (application) used for the monitored communication between the two nodes (DieboU 
col.6 lines 52-56 and fig. 2). "A network manager can ask the system to identify all of the servers 
that a particular node is talking to (destination); to identify all of the traffic between two 
identified nodes; to identify the protocols (apphcation) that are being used over a particular line; 
etc.", (Diebboll col. 5 lines 25-29), 

Therefore at the time the invention was made, it would have been obvious to a person of 
ordinary skill in the art to modify the above invention suggested by Kosbab in view of McKee 
and combining it with the invention disclosed by Diebboll. 

One of ordinary skill in the art would have been motivated to do this combination in 
order store in the database the best information about the traffic between two identified nodes, 
(Diebboll col. 6 lines 18-29) and to create a way to discover what is the network topology and 
using that information to help in generating reports about the network, (DieboU col. 1 lines 58-60 
and col. 1 lines 63-67). 

Regarding claim 28, the above combination discloses all the Umitation in claim 27, and 
also discloses wherein the data storage comprises a database (Kosbab discloses a data storage, as 
a memory, that comprises a database fig.3). 

Allowable Subject Matter 
Claims 7, 8, 9, 22, and 23 are objected to as being dependent upon a rejected base claim, 
but would be allowable if rewritten in independent form including all of the Umitations of the 
base claim and any intervening claims. 
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Response to Arguments 



Applicant's arguments filed February 23, 2004 have been fiilly considered but they are 
not persuasive. 

As the appHcants' arguments filed on February 23, 2004, the appUcant argue in 
substance: 

a) that none of the prior art documents identify data relating to relevant server protocols, 
and from that data, determining a device as a server, if it has the highest data volume and if at 
least a threshold number of other devices are involved. 

In response to arguments, Kosbab teaches comparing or matching frame information to 
server frame type (identify), from the received data, data relating to one or more relevant server 
protocols. The examiner recognizes that Kosbab does not teach to identify as a server, the device 
that has the highest data volume for communications and that at least a threshold number of 
other devices are involved. However McKee teaches identifying the candidate local server with 
the highest linkage which is measured in terms of the number of frames involved in the traffic 
with the associated nodes, number of associates nodes (that is, a plurality of nodes which means 
more than one, being this a threshold), and the number of bytes involved in the traffic with the 
associated nodes. 

b) that there is no motivation to combine the teaching of Kosbab with either DieboU or 



In response to argument, the motivation to combine Kosbab with McKee is in order to 
upon local servers being identified, make a suggestion as to whether any of these local servers 



McKee. 
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should be moved to another logical segment and as to be worthwhile splitting a segment between 
two associated local segments, to provide a network analysis method that facilitates an 
appreciation of operation of the network at a sub-network level, and for once the local server 
being identified, further analysis can be effected to determine how network performance can be 
improved. The motivation to combine Kosbab in view of McKee with the Dieboll is to collect 
data in accordance with a known standard as RMON II which was promulgated by the Internet 
Engineering task force, which specifies as a protocol for communicating with the probe and 
specifies the format of the Management Information Base (MB), which defines the kinds of data 
that is stored and how to collect and retrieve that data, to store in the database the best 
information about the traffic between two identified nodes, to create a way to discover what is 
the network topology, and using that information to help in generating reports about the network. 
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Conclusion 



TfflS ACTION IS MABE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 
CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Xiomara Y. Ortiz whose telephone number is (703) 305-6783. 
The examiner can normally be reached on Monday-Thursday from 8:30AM to 5:30PM. The 
examiner can also be reached on alternate Fridays. If attempts to reach the examiner by 
telephone are unsuccessful, the examiner's supervisor, Rupal Dharia can be reached on (703) 
305-4003. Any inquiry of a general nature or relating to the status of this apphcation or 
proceeding should be directed to the receptionist whose telephone number is (703) 305-3900. 



Xiomara Y. Ortiz 
Patent Examiner 
Art Unit 2141 
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